The problem
The main problem is, that most traffic monitoring tools only report the usage per network interface (WLAN / LAN / UMTS) - but not per application. But that's necessary if you want to identify the consuming application.
The second type of monitoring tools only show send/received bytes for active connections. As soon as a connection drops or the program is terminated, the consumed traffic isn't shown anymore and the tool gets useless.
Application comparison
I compared some popular tools to find one that combines the benefits of both worlds. The winner was Nirsofts NetworkTrafficView together with WinPcap driver. It was the only one which summed up send/received bytes from all connections per application.
NetworkTrafficView is a network monitoring tool that captures the packets pass through your network adapter, and displays general statistics about your network traffic. The packets statistics is grouped by the Ethernet Type, IP Protocol, Source/Destination Addresses, and Source/Destination ports.
- You have to install WinPcap driver first
- Under Advanced options » General grouping » select Group by process
That is the important option which all other tools lack.
A small downside is, that UDP packets aren't counted, but that shouldn't affect the result as much.
- Hide all unnecessary columns like shown above in screenshot
- Sort by Total packets size
What other tools I tried
Sums up consumed traffic only per interface
Sums up consumed traffic only for active connections
Untested